Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents
Open accessAbstract
Long-lived AI agents increasingly evolve after deployment by retaining experience, acquiring skills and tools, revising workflows, delegating work, and moving across task phases. This improves adaptation but creates a distinct authorization problem. Tool-enabled agents can turn model errors and prompt injections into consequential external actions; when evolution occurs under a live grant, the subject exercising that authority or the context in which it acts may no longer match what the user evaluated. Evolution can change both the effects reachable under an old grant and the authority required by the task, which may rise, fall, or become incomparable. Existing tool policies constrain actions but do not determine when a grant survives this change. We formulate authorization continuity: when does an existing grant remain valid, how may active authority change, and what boundary must never move? Our state-bound model fixes a transition envelope and an immutable effect ceiling at grant time. The envelope determines whether the grant survives a mutation; below the ceiling, authority may contract freely and expand only under specified evidence conditions. We distinguish requested from realized effects and prove that, under complete mediation, sound effect abstraction, attenuating delegation, and monitor integrity, mutation cannot amplify protected effects beyond the user-issued ceiling. Agent-produced evidence may allocate authority below the ceiling but cannot raise it. Finally, we map six mutation classes to their authorization consequences.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Earned Authority binds authority to a grant-fixed transition envelope and immutable effect ceiling, covering multiple classes of security-relevant change and proving conditional non-amplification.
“Earned Authority directly addresses whether an evolving agent may retain a grant after a transition. It binds authority to a grant-fixed transition envelope and immutable effect ceiling, covering multiple classes of security- relevant change and proving conditional non-amplification [37].”
From Authorization for Self-Modifying AI Agent Populations: Conserving Authority across Replacement, Forking, and Rollback (2026) · cites this paper as [37]
Earned Authority's stated boundary leaves cross-generation revocation and population-level authority open.
“Its stated boundary leaves crossgeneration revocation and population-level authority open.”
From Authorization for Self-Modifying AI Agent Populations: Conserving Authority across Replacement, Forking, and Rollback (2026) · cites this paper as [37]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Gödel Agent: A Self-Referential Agent Framework for Recursive Self-Improvement
Yin, X., Wang, X., Pan, L., Lin, L., Wan, X., & Wang, W. Y. (2024) · arXiv · doi:10.48550/arxiv.2410.04444 · Cited by 2 · see citing works
From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents
Dash, P., Ge, T., Jain, A., Shah, T., & Shang, Z. (2026) · arXiv · doi:10.48550/arxiv.2606.04329 · cited 3×
“Content that informs one local answer may be irrelevant; content persisted into memory, a skill, or a future plan changes the control policy that will reuse the grant [20], [21]. b) Capability and delegation.”
Flagged first, then by citations
Research works printed but not linked: 29
- H.-a. Gao, J. Geng, W. Hua et al., "A survey of self-evolving agents: What, when, how, and where to evolve on the path to artificial super intelligence," arXiv preprint arXiv:2507.21046, 2025, version 4, January 2026; 28 authors, list abbreviated. · arXiv
- J. Zheng, C. Shi, X. Cai, Q. Li, D. Zhang, C. Li, D. Yu, and Q. Ma, "Lifelong learning of large language model based agents: A roadmap," arXiv preprint arXiv:2501.07278, 2025. · arXiv
- N. Shinn, F. Cassano, E. Berman, A. Gopinath, K. Narasimhan, and S. Yao, "Reflexion: Language agents with verbal reinforcement learning," arXiv preprint arXiv:2303.11366, 2023. · arXiv
- A. Zhao, D. Huang, Q. Xu, M. Lin, Y.-J. Liu, and G. Huang, "ExpeL: LLM agents are experiential learners," arXiv preprint arXiv:2308.10144, 2023. · arXiv
- G. Wang, Y. Xie, Y. Jiang, A. Mandlekar, C. Xiao, Y. Zhu, L. Fan, and A. Anandkumar, "Voyager: An open-ended embodied agent with large language models," arXiv preprint arXiv:2305.16291, 2023. · arXiv
- S. Hu, C. Lu, and J. Clune, "Automated design of agentic systems," arXiv preprint arXiv:2408.08435, 2024. · arXiv
- J. Zhang, S. Hu, C. Lu, R. Lange, and J. Clune, "Darwin gödel machine: Open-ended evolution of self-improving agents," arXiv preprint arXiv:2505.22954, 2025, revised March 2026. · arXiv
- Z. Zhang, L. Yu Zhang, X. Zheng, B. Hussain Abbasi, and S. Hu, "Evaluating membership inference through adversarial robustness," The Computer Journal, vol. 65, no. 11, pp. 2969-2978, 2022.
- Z. Zhang, L. Y. Zhang, X. Zheng, J. Tian, and J. Zhou, "Self-supervised adversarial example detection by disentangled representation," in 2022 IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom). IEEE, 2022, pp. 1000- 1007.
- Z. Zhang, X. Zhang, Y. Zhang, L. Y. Zhang, C. Chen, S. Hu, A. Gill, and S. Pan, "Stealing watermarks of large language models via mixed integer programming," in 2024 Annual Computer Security Applications Conference (ACSAC). IEEE, 2024, pp. 46-60.
- X. Zhang, Z. Zhang, Y. Zhang, X. Zheng, L. Y. Zhang, S. Hu, and S. Pan, "Exploring gradient-guided masked language model to detect textual adversarial attacks," IEEE Transactions on Audio, Speech and Language Processing, vol. 34, pp. 1763-1774, 2026.
- Z. Zhang*, X. Zhang*, Y. Zhang, H. Zhang, S. Pan, B. Liu, A. Q. Gill, and L. Y. Zhang, "Character-level perturbations disrupt llm watermarks," in Network and Distributed System Security (NDSS) Symposium 2026, 2026.
- X. Zhang, Z. Zhang, L. Y. Zhang, Y. Zhang, G. Tao, and S. Pan, "Less is more-until it breaks: Security pitfalls of vision token compression in large vision-language models," arXiv preprint arXiv:2601.12042, 2026. · arXiv
- L. Beurer-Kellner, B. Buesser, A.-M. Cret ¸u, E. Debenedetti, D. Dobos, D. Fabian, M. Fischer, D. Froelicher, K. Grosse, D. Naeff, E. Ozoani, A. Paverd, F. Tramèr, and V. Volhejn, "Design patterns for securing llm agents against prompt injections," arXiv preprint arXiv:2506.08837, 2025. · arXiv
- E. Debenedetti, I. Shumailov, T. Fan, J. Hayes, N. Carlini, D. Fabian, C. Kern, C. Shi, A. Terzis, and F. Tramèr, "Defeating prompt injections by design," arXiv preprint arXiv:2503.18813, 2025. · arXiv
- W. Zhao, Y. Zhang, Y. Wang, Y. Deng, Y. Zhao, X. Zhi, Y. Huang, H. He, W. Che, B. Qin, and T. Liu, "On safety risks in experience-driven self-evolving agents," arXiv preprint arXiv:2604.16968, 2026. · arXiv
- K. Wang, J. Lou, Z. Zhou, and J. Li, "Oep: Poisoning self-evolving llm agents via locally correct but non-transferable experiences," arXiv preprint arXiv:2605.18930, 2026. · arXiv
- T. Chen, Z. Jiang, Y. Hu, Y. Gou, and N. Z. Gong, "Dynamic malicious skills in agentic ai," arXiv preprint arXiv:2606.16287, 2026. · arXiv
- Z. Zhou, "Governing dynamic capabilities: Cryptographic binding and reproducibility verification for ai agent tool use," arXiv preprint arXiv:2603.14332, 2026. · arXiv
- J. H. Saltzer and M. D. Schroeder, "The protection of information in computer systems," Proceedings of the IEEE, vol. 63, no. 9, pp. 1278- 1308, 1975.
- Y. Li, Y. Chen, P. Wang, I. Khabra, F. H. Shezan, Y. Feng, and Y. Tian, "Options, not clicks: Lattice refinement for consent-driven mcp authorization," arXiv preprint arXiv:2605.11360, 2026. · arXiv
- T. Shi, J. He, Z. Wang, H. Li, L. Wu, W. Guo, and D. Song, "Progent: Securing ai agents with privilege control," arXiv preprint arXiv:2504.11703, 2025, revised 2026; earlier versions titled "Progent: Programmable Privilege Control for LLM Agents". · arXiv
- T. Zhou, L. D'Antoni, and N. Polikarpova, "Language-based agent control," arXiv preprint arXiv:2605.12863, 2026. · arXiv
- S. Pan, X. Sun, T. Zhang, D. Liao, K. Yang, and Z. Xing, "Skillguard: A permission-centric framework for agent skill security," arXiv preprint arXiv:2606.03024, 2026. · arXiv
- S. Shao, Q. Ren, C. Qian, B. Wei, D. Guo, J. Yang, X. Song, L. Zhang, W. Zhang, D. Liu, and J. Shao, "Your agent may misevolve: Emergent risks in self-evolving llm agents," arXiv preprint arXiv:2509.26354, 2025, version 2, March 2026. · arXiv
- R. Lin, X. Deng, Q. Li, J. Ma, Y. Feng, Y. Qing, Z. Li, Y. Zhang, S. Cui, C. Meng, T. Zhang, X. Ma, Q. Li, K. Xu, and S. Ji, "Safety in self-evolving llm agent systems: Threats, amplification, and case studies," arXiv preprint arXiv:2606.23075, 2026. · arXiv
- A. Joshi, T. Finin, K. P. Joshi, and L. Kagal, "Deontic policies for runtime governance of agentic ai systems," arXiv preprint arXiv:2606.19464, 2026. · arXiv
- N. Hardy, "The confused deputy: (or why capabilities might have been invented)," ACM SIGOPS Operating Systems Review, vol. 22, no. 4, pp. 36-38, 1988.
- C. Schroeder de Witt, K. Krawiecka, I. Krawczuk et al., "Open challenges in multi-agent security: Towards secure systems of interacting ai agents," arXiv preprint arXiv:2505.02077, 2025, version 2, April 2026; 24 · arXiv
Cited by
Sorted by citations
Zhu, G., & Wang, C. (2026) · arXiv · doi:10.48550/arxiv.2610.00347
- Authors
- Zhang, Z., & Zhang, X.
- Affiliations
- University of Technology Sydney (AU)
- Griffith University (AU)
- Venue
- arXiv
- Publisher
- arXiv
- Published
- 2026
- ISSN
- 2331-8422 (ISSN-L)
- arXiv
- 2607.23586
- OpenAlex
- W7171507346
- Cited by
- 0
- References
- 2
- Type
- posted content
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Social Sciences › Sociology and Political Science › Access Control and Trust
- Physical Sciences › Computer Science › Information Systems › Digital Rights Management and Security
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- delegation, prompt injection, model error, mediation, agent autonomy
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
